What do you want to know?

Companies is one list of every outside company you deal with: clients, contractors, suppliers, owners, occupiers, auditors. Each company is on the platform once, whatever it does for you, so a contractor who also supplies parts is one card with two roles.

Check a company against Companies House (other countries’ registries later) to tick it as verified. A company that is dissolved or in liquidation shows red.

Give a company access by choosing what they are to you (contractor, owner, operator, occupier, auditor) and which sites they work on. They see those sites and nothing else; a contractor sees only the jobs you hand them. Their people never take a seat.

See as them shows exactly what a company will see, before and after you share, with anything unusual flagged. Every look is recorded with who looked and why.

Pause shuts a company’s people out at once and keeps everything as it was. End closes their access for good; jobs handed to them close, and the history stays on both sides.

The owner of the assets always sees their sites and the work done on them. That cannot be switched off by whoever hosts the records.

Hand a job to a company you work with. If they have their own workspace they link it to their own job, so both of you see the same job and its progress without typing it twice; what they say (on site, started, done) appears on your job. You close it.

Work for others lists every client that has let your company in: accept a new one, see the jobs they handed you, link them to your own jobs and tell them when you start and finish. Each client sees only its own jobs.

A custody handover passes a site, an asset or a job to another company’s workspace when a contract changes hands. Both Owners sign, and each side keeps the same record with the same fingerprint. Your private notes and rates never travel.

People from another company can work offline too: their phone keeps only what their company’s access shows, and nothing else of yours.

An asset is anything you maintain: a boiler, a lift, a pump, a door. It always has a place (where it is) and a class (what kind of thing it is).

Asset numbers are minted on the server, A-00001 upwards, and never reused. Old numbers from another system are kept as aliases and still find the asset.

Classes come from the library (boilers, AHUs, fire alarms, inverters...) with their usual words as synonyms. Adopt the ones you use; make your own when none fits.

A class Athena chose is provisional until a person confirms it. The compliance pages say when duties may be missing because of that.

Before an asset is saved, the same serial, the same old number or the same name at the same place is flagged. Open the existing one, or save anyway with a reason.

An asset can be part of another (a motor in a pump, a pump in a plant). Moving an asset takes its parts with it. An asset can never sit inside itself or under a retired asset.

Retiring an asset keeps its history. Choose what happens to the parts under it: retire them too or move them up. Only a person can retire or dispose; Athena never does.

Drop in a CSV, Excel or JSON file. Columns are matched to fields by their headers, dates and numbers are read in any common form, and nothing is written until you press Run. A dry run shows what would happen.

Photograph the rating plate and press Read the plate. Athena reads it twice with two models and shows maker, model, serial, year and ratings, each marked clear or check. Nothing goes on the asset until you tick what to use; anything you type over counts as typed.

A value the plate does not show is left blank, never guessed; characters the two reads disagree on show as ?. Writing on a photo that tries to give instructions is never followed: the reading is flagged and waits for a person. AI work is priced in credits.

An import matches rows to existing assets by serial, then old number, then number, then the same name at the same place. Existing values are kept unless you choose Replace.

An import can be undone for seven days: assets it created are removed, values it changed go back.

Every sticker carries a random code and opens predictandmaintain.com/q/<code>. Print pre-printed batches and bind them on a walk-round, or print one per asset.

A lost label still resolves, with a note that it was lost, so an old photo of it still works. A replacement code is minted for the same asset.

Anyone who scans a label sees what you choose: the name, where it is, its status, and a Report a problem button. Never people’s names or costs.

Export the register or one site as CSV, Excel or JSON with every column, custom attributes and the hierarchy as a path. Your data is always yours to take.

Change many assets at once (class, place, criticality, condition, find and replace in names). Every change is kept and can be undone for seven days.

Criticality scores five things from 1 to 5: safety, keeping things running, the law and insurance, cost if it fails, and environment. The worst one decides the band, so one serious consequence makes a thing critical.

Athena drafts a criticality for equipment that has none, from its kind and its own records. A person checks each draft; nothing counts until they approve it, and she never changes one a person set.

Record a condition from A (as new) to E (very poor). It sets how much life is left and the year to replace it, which the capital plan reads. D brings replacement within two years; E means now.

Each night the register is checked for two records that are one thing: the same serial, or the same name at the same place. Merge them and everything on the duplicate (jobs, warranties, labels, requests, documents, what sits under it) moves to the one you keep. Undo puts it all back for 30 days.

The make and model catalogue holds each maker and model once, with its expected life. Fill it from the register links every asset that names the same maker and model.

Register Health lists what is missing or wrong in the register each night: classes not confirmed, no criticality, no condition, no install date, critical equipment in poor condition, possible duplicates, no label. Each line says what to do.

A work order is one piece of maintenance work, from the moment someone raises it to the moment the record of it is sealed. Corrective, preventive and inspection work are all work orders, each with its kind.

Numbers are minted on the server per kind and year: WO-CM-26-00001 for corrective work, WO-PM-… preventive, WO-IN-… inspection. A job raised with no signal shows a pending number until the phone syncs.

Raise work with one line of text and a place. An asset is optional: work on the site or a room is site-level work. Pick a template to get its task list.

A work order is draft, open, scheduled, in progress, on hold, completed, closed or cancelled. Completed means the person who did it says it is done; closed means it was accepted and sealed.

On the phone a job is one screen of stations in the order work happens: Brief, Start, Tasks, Parts, Close-out, Sign-off, Finish. A quick fix shows only Start, Tasks and Done.

Arrival is recorded in one place only, the job’s Start station. Tapping “I’m here” twice does nothing the second time.

“Pass all remaining” ticks every task left after showing how many. Safety-critical tasks and readings are never passed in bulk; they are done one at a time.

A reading outside its limits asks you to fail the task or add a note saying what you did. A zero is a reading.

Complete checks the job first: every required task done or marked N/A with a reason, every reading in, the photos the tasks ask for, and a summary when there were no tasks. Anything missing is named.

You can complete a job while photos are still uploading. It shows “completed, evidence uploading” and is sealed when the last photo arrives.

Completed work is closed by a reviewer, or by the person who did it when the setting says so or nobody else can review. A one-person business’s job ends Done.

A closed work order is sealed with a SHA-256 audit identifier over everything recorded on it. The report recomputes it every time and says if anything changed.

A sealed record is never edited. A correction keeps the old value, the new one, who, when and why, and writes a new identifier. Reopen puts the job back in progress.

A photo that reaches the server after the job was completed or sealed is never refused: it is added as dated late evidence with its own identifier.

Hours are recorded from the timer, typed, or proposed from arrival to departure for you to confirm. They are hands-on hours; pay and cost are elsewhere.

Templates hold a job plan: tasks, readings and limits, the station profile and the estimated time. Adopt your sector’s starter set, make your own, or save a finished job as one.

Completed work waits on Review. Each job says Clean, Needs a look, or Safety: human close with the reason. Close all clean never includes a safety job.

A person always closes: work on a safety-critical asset or a fire, gas, lift, pressure or other life-safety system; work with a permit or isolation; a linked safety action; a failed check or a reading outside its limits; statutory work; a disputed job; an uncoded repair where coding is required; and a job sent back before. No rule can change that.

Athena closes a clean job by herself only under a rule your organisation wrote, and never safety work. The record says “Closed by Athena” and the rule. A reviewer can unseal it within 30 days.

Send back returns a completed job to in progress with your note pinned on it. The technician signs again when it is done again.

On a repair you say what failed and why. You are asked, not made, unless an Admin makes it required (or required for teams of more than three). “Not sure” always completes.

Athena drafts the close-out from what you recorded. Accept as written and it shows “AI draft, check it” until someone edits it.

Merge folds a duplicate repair into the job it repeats. Nothing is lost: the duplicate keeps its records and shows Merged, its requests follow the job that stays, and Unmerge puts it back.

Search finds work by number however you type it (123, CM 123, WO-CM-26-00123), by label, by words and the other words people use for them, and through small misspellings.

Changing a template makes its next version. Work already raised keeps the version it was raised from; after Publish you can update open work nobody has started.

Repeat this makes a planned maintenance plan from a job: the same tasks or template, on the same equipment, every so many days, weeks, months or years.

Can’t get in, or can’t go on, on the job: say what happened (no access, cancelled at the door, refused entry, not safe, parts, weather). No access needs proof: a card left, a call made or a photo of the door. Each visit that ends at the door counts as an attempt, and the planner books it again for another time of day.

Not finished today: say how long is left and what the next visit needs. Only what is left is planned again, and the job keeps a summary for each visit.

Follow-up work offered at close-out is raised with one press as a new job linked to this one, or marked Not needed with why. A follow-up is never raised twice: if the same work is already open on the asset, add to that job instead.

A callout is reactive work out of hours: when the call came in, when someone must be on site by, who accepted it and when they arrived are all on the job. Accept it, leave home and tap I’m here, or fix it on the phone. A callout becomes a repair with Convert kind and keeps its number.

Fixed first time is worked out when the job is completed: one visit on site (or none, fixed on the phone), no visit that ended short and no follow-on job. A callout that needs a return visit raises follow-on work from the close-out.

Customer sign-off on the phone: hand it over and the customer sees the report of the job, types their name and accepts, declines with why, or asks a question. What they sign is fixed to what they saw: if the job changes while the screen is open, they are asked to look again. A signature is never changed afterwards.

Send for sign-off sends a one-time link to the customer’s copy of the report, by email, text or WhatsApp, to one of the contacts on the job’s site; or make a link to copy and send it yourself. It works once, runs out after 14 days unless your organisation sets another time, and a newer link replaces it. The customer needs no account. The job keeps only a fingerprint of the link, never the link itself.

The job report has your organisation’s name, your accent and your own words at the top and the end. The customer’s copy shows what was done, the parts, extra work that was agreed, photos and who signed; never your internal brief, hours or costs. Your own copy adds hours, and costs for people who may see them.

Extra work found on site is asked for on the job with what and why, a price and photos if there are any, and is agreed or turned down before it is done, with who agreed, as who and how (in person, on the phone, in writing). A job cannot be completed while extra work is waiting for an answer.

Costs on a job: hours at your own labour rate per rate (normal, overtime, callout, travel, standby) or for one person, parts at their cost when they come from stock, and contractor and other costs typed in. They are posted when the job is completed. A cost that is not known yet is shown as not known, never as nothing.

A job’s Parts and costs shows what was expected beside what it cost, by labour, parts, contractors and other costs. A cost with no price yet is counted, never shown as nothing, so the actual reads “at least”.

Post to the ledger puts the job’s priced costs into the money ledger once each; a cost removed afterwards is taken off by a reversing line that names it, never by deleting. Budgets, projects and outages all read the same ledger.

The estimate is a person’s: save the lines you expect by kind. Saving again replaces the earlier lines and keeps them in the history.

A procedure (standard, emergency or a method of procedure for a change on live plant) is a list of steps with what to expect. A version is approved by someone who did not write it and is frozen; a change is a new version.

A method of procedure cannot start until a second person has approved the change it makes. A step that takes a path away asks you to confirm the other path is carrying the load. A reading outside its range holds the run until a person releases it or backs out.

A step with a verifier is checked by a different person, who reads back what they see. If the words do not match, the step is not verified.

Claim an expense on the job with its receipt photographed (travel time and mileage need none). Someone who did not claim it approves it; it then shows as a cost on the job and goes on the ledger with the rest.

Grade the work from 1 to 5 once it is done. When your organisation sets a minimum grade, a job below it is left off the monthly invoices until it is graded again, and the invoice draft says how many were held back.

A job can carry a workmanship warranty for a number of days. A repeat job on the same equipment inside it can be raised as a callback: not chargeable unless a person decides it is not a callback. The one who did the work may contest it with why.

A change to plant or process is raised by one person and approved by another. A job tagged as a modification under a change cannot start until that change is approved.

A plan says what routine work an asset gets and how often: “every 3 months”, or once on a date. Write it once and put it on as many assets as it suits.

Changing a plan makes a new version with your reason. The version in use keeps running until you activate the new one, and work orders already made keep the version they were made under.

Floating counts the next visit from the day the last one was done; fixed keeps to the calendar whatever happens. A late visit pushes a floating plan on and leaves a fixed one where it was.

Each visit has a window around its due date, a share of how often it is done (10% each side unless you change it, at least a day and at most 30). Done by the window’s last day counts as on time.

The work order appears a set number of days before the visit is due: 14 unless the plan says otherwise. That is when it reaches the planner and the board.

Each visit can be made once only. Running the Generator again, or two of them at once, finds the visit already there and makes nothing more.

The Generator runs every night at 02:00 at each site’s own time, and again within a minute of a plan being activated, put on assets or changed, or a closed day being added. Every run is in the run log with what it made.

Closed days come from one calendar for the whole product: public holidays, site closures and days closed every week. A visit due on one moves to the next open day, or the one before if the row says so. Work orders already made are not moved; they show that they now fall on a closed day.

Public holidays can be added in one go from the built-in table for England and Wales, Scotland, Northern Ireland, Ireland or the United States. Each one is marked to check until someone confirms it for the year.

One asset can be done differently: another interval or a new next due date, with a reason and an optional end. The plan itself stays as it is.

Suspend a plan, or one asset’s plan, with a reason while the asset is out of use. On resume, keep the calendar or count again from today. Nothing missed while suspended is made afterwards.

Skip a visit with a reason before its work starts. Some reasons leave the compliance figure (the asset was out of service); others count against it (no access). Athena never skips a visit by itself.

PM compliance is the share of visits due that were done by the last day of their window. Late work still closes the job but counts against the figure. With nothing due yet it shows a dash, not 0%.

New plan has three ways in: describe it in your own words and Athena drafts it, pick a ready-made plan from the library, or fill it in yourself. Every way ends in a draft; nothing makes work until you approve it.

Each step of a drafted plan says where it comes from: the library, your maker’s manual, your own words, or “No source: check it”. A plan is never drafted longer than the strictest source it uses.

Besides “every 3 months”, a plan can run on chosen days of the week, a set weekday each month (the first Tuesday), the last working day of the month, or every few hours from a set time, which keeps its times through the clock changes.

If the last visit is still open when the next falls due, the plan can make the next one anyway, skip it and say why (it does not count against compliance), or add it to the open job.

A plan can say it needs the plant stopped, for how long, and whether operations must release it first. The work order says so too.

Tick “Visits due together at a site share one work order” and the visits due in the same window at one site come as one job, with a part for each asset.

Bring the schedule you keep now (Excel or CSV): each task becomes a draft plan on the equipment it names, next due from when it was last done. Overdue ones are said, and their first work order comes as soon as you approve them.

Your makers’ recommendations (from their manuals) are kept per make and model, with where the manual says so. Athena uses them when she drafts a plan for that equipment.

The overdue queue lists every planned visit past its window, and those about to miss it with nobody planned. Legal duties come first, then safety-critical equipment, then the most critical, then the longest late. Every row shows its work order number.

Athena proposes one decision a row: escalate it to the compliance lead, chase whoever has it, skip it when the equipment is retired, or plan it. Nothing happens until you press it. A legal duty or safety-critical equipment is decided one by one, never in “Apply Athena’s proposals”, and never skipped here.

A plan built from a library row that a law usually sets (a lift or hoist thorough examination, a gas safety check, an EICR) shows “Legal duty (basis unverified)” until someone marks it statutory with its legal basis. It is ranked first and escalated when it is overdue.

The year view shows every plan week by week: visits done, made and forecast, the hours each week takes against the hours you have, and closed weeks. The line under the title says if it is balanced, or which month is over and by how much.

“Level the programme” has Athena propose new dates for visits not made yet, each inside its own window, to even out the weeks. A legal duty is never moved later and a visit already made never moves. Nothing changes until you say yes, and you can pick which moves to take.

For a new site whose plans all start at once, “Spread the first visits” lets Athena bring first visits earlier, by up to one interval, so the year’s work is not all in one month. Still never later than the window, never a legal duty later.

Copy a site’s programme to another site: its plans go on the other site’s equipment of the same kinds, first visits spaced from the start date you pick as they were at the first site. Equipment already on a plan is skipped and listed. You see the counts before anything is copied.

Coverage lists equipment in service with no plan on it, by kind, most critical first, and plans with no equipment. Pick some and Athena drafts plans for them.

When a planned visit is done, any failed step or reading outside its limits becomes a finding on the visit. Record what the equipment was found in and left in (good, fair, poor, failed), and raise a follow-up job from a finding.

Each plan is checked as you write it: vague steps, readings with no limits, an interval longer than the law usually allows, a legal duty not yet marked, work at height or live work, another plan doing the same job, and minutes far from what the jobs took. The warnings never stop you saving.

A plan can be due on a meter: “every 500 hours” or “every 10,000 km”. Its work order is made when a reading reaches the plan’s window, never on a forecast alone; until then the year view dates it from the meter’s readings.

Readings lists the meters to read now, the longest unread first. Type the number and save; if it looks wrong you are asked once what happened, and nothing is changed for you.

Statutory plans, with their legal basis, a second approver and deferrals, arrive with the compliance module. Until then no plan is marked statutory.

A condition trigger brings a plan’s next visit forward when a reading goes over or under a limit, the equipment’s health drops to a band, or an alert is open. The visit is made at once, never twice while one is open, and not again inside its cooldown. A reading more than 7 days old is not acted on.

The Frequency Optimiser looks at what each visit found and what failed between visits, and proposes one step shorter or longer. It needs 6 visits or 12 months first. A legal duty is never made longer.

A person decides each proposal. Yes makes a new draft version of the plan with the new interval; activating it is your own step. The person who asked for a proposal does not decide it, and critical equipment needs a second person.

At the close-out of a repair you say what failed and why: the failure, its cause, how it was found and what was done. Codes for the job’s trade come first; “Show all” has the rest.

“No fault found” is an answer of its own, with the reason: reset only, comes and goes, could not make it happen, false alarm or fixed itself. It has no cause.

“Not sure” always lets you complete the job. A reviewer codes it later; until then the job is not closed by Athena.

Mean time between failures shows a dash until an asset has two failures: one failure says nothing about the time between them. “No fault found” and “Not sure” are not counted as failures.

The code lists start with a starter set. An Admin adds codes, renames them or retires them; a retired code stays on the records that have it, marked retired.

When a repair is finished, Athena reads the close-out and suggests what failed, why, how it was found and what was done, from your own code lists. The suggestion is shown in the FailurePicker and the coding queue; you confirm it in one tap or pick your own. Athena never writes a code itself and never changes yours.

The coding queue lists Athena’s suggestions waiting for a person, and finished repairs that still have no complete code. Confirm as suggested, or change and confirm; closed jobs can be coded here too.

Bad actors ranks your equipment by failures and downtime over the last year, worked out from the failure records: the few assets that cause more than half of the failures, repairs that did not hold (failed again within 30 days), failure modes, age at failure and a weekly chart with its limits. With fewer than five failures the page says so instead of drawing conclusions.

Availability holds each site’s figure for each day: the figure reported and, where it was corrected, the revised one, which is the one that counts. A day needs a figure or a reason; a day with neither is shown as missing, never as zero. A revision that lowers what is owed by more than your threshold waits for a second person.

Exclusions are periods taken out of a guarantee: planned maintenance windows, grid events, client-caused stops and the like. Athena drafts them from outages that are back in service, with the plant-off and plant-back times as evidence, but only for the kinds your contract excludes. A person claims each one and records the client’s answer. A day wholly inside a claimed or agreed exclusion is left out of the cycle.

The LD position for each cycle is worked out by the system from the daily figures and the guarantee’s terms, with the equation shown: for example 10 MW × (98 − 97.83) ÷ 100 × the rate. No model ever works out a figure. A person confirms a position (two people where your terms say so), and a confirmed position never changes.

Defect elimination lists the equipment whose failures you are working to stop for good, worst loss first. The loss a year is the hours down at what an hour down costs, plus what its jobs cost on the money ledger; without the hourly figure the downtime is said, never priced at nothing.

Mark the fix date and the year before it is frozen. After 90 days with no repeat failure a person can call it eliminated, and the saving a year is worked out from before and after. A failure after the fix says the fix has not held.

A confirmed damages position goes on the client’s next invoice as a deduction, once. Ready to bill picks it up with everything else, and the position shows where the line has got to.

A service credit is worked out for an operator’s month at a site: the points of availability below the target times the credit for each point, never more than the month’s cap. Finance puts a confirmed credit on that operator’s next invoice as a deduction, once.

The scorecard feed shows, for each contractor or team who guaranteed their work, how many jobs they guaranteed, how many came back as callbacks and were upheld, and how many repeat jobs followed within 30 days.

The client review is the defect register without names, notes or what an hour down costs you: what was found, on what equipment, where it stands and what it saved.

A reliability study (RCM or FMECA) works through what the equipment must do, how it can fail to do it, each way it fails, what that leads to and what to do about it. The task is worked out from your answers: check its condition, restore or replace on a schedule, test a hidden function, run to failure, or change the design.

A study is signed by people. The person who wrote it does not approve it, and one with a safety, environmental or hidden consequence needs two different people. An approved study does not change; a new version does.

Life data shows how long each kind of equipment lasts between failures. A Weibull fit is drawn once there are 8 failures with their times; below that the page says how many more are needed. Equipment still running counts too. Beta below 1 points at early-life failures, about 1 at random ones, above 1 at wear-out.

Give what a planned replacement and a failure each cost, and the page works out the age at which replacing costs least per day. It only does when failures come with age and a failure costs more.

A bundle is the set of changes a signed study (or a life data fit) recommends: a draft maintenance plan for each task done on a schedule; for a task that checks the condition, when the person proposing says how it is checked (vibration, thermography, oil analysis and the rest), a check in the condition monitoring programme for each piece of equipment the study covers instead; and any spares they name for a failure mode (the part, the store it is held in, how many to hold back) on the critical spares register. One person proposes it and a different person approves it; Athena does neither. Applying makes each change through its own module, as the person who presses it; a check already in the programme is left as it is. Switching each plan on is still done on the plan page. Rolling back retires the plans, stops the checks and takes the spares off the register.

Life data offers more than one fit. The straight-line fit is the everyday one. The best-likelihood fit gives a range: nine times in ten (90%) the true beta lies inside it. A failure-free period is shown when nothing fails before a certain age. With several failure codes, each gets its own fit and the combined curve shows when one in ten has failed, whatever the cause. Each needs 8 failures with their times.

With 20 or more of the same kind of equipment, the page also shows whether failures across them are coming closer together or further apart. If they are, a repair is not bringing them back to as good as new, and the page says to read the trend rather than the ordinary fit.

Compare ways of looking after a kind of equipment: run it to failure, replace it on age, check its condition, or change the design. Give what a planned job and a failure each cost; the page plays out 1000 possible futures from your own life data and shows the cost a good year (P10), a middle one (P50) and a bad one (P90). The same inputs always give the same figures.

The library has 10 starting studies (pumps, chillers, solar inverters, uninterruptible power supplies, passenger lifts, air handling units, air compressors, transformers, conveyors and sorters, standby generators). Adopting one copies it into a draft study that is yours to change; every rating says it came from the library until you change it. Check it against the maker’s manual.

Athena drafts failure modes beside a draft study: from the library for its kind of equipment, or from the functions and failures you have written. How often a mode happens comes from your own failure records (the last 3 years) or the library, never a guess; when neither covers it, you rate it. Each draft waits for you to take it in or turn it down.

Download any study as an FMEA worksheet in Excel, one row per failure mode. You can start a study from a worksheet too, in Excel or CSV with the same headings: every row is checked first and any problem is listed by its row number. The task is always worked out again from the answers.

Need something? asks for a part or a service, from a job or on its own, in words or with a photo. If the part is already in a store it says so straight away. From a job, the job shows it is waiting on it.

A supplier is a company on your list that you buy from. Set it up as a supplier, then someone who may approve suppliers approves it. Orders go only to approved suppliers.

Orders go to the address on the supplier, and nowhere else. Changing it is confirmed another way first: a call to the number you already had, a reply from the old address, or a second person. Every change is kept.

Each order line shows its net, its tax code and rate, and its gross, from your workspace’s tax codes. The rate is the one in force on the day the line was priced; a later change of rate never changes a sent order.

An order whose total with tax is above your approval band needs someone other than the person who raised it to approve it before it is sent. Change the band in the buying settings.

Every order is sent by a person. Athena can draft one (Order short) and suggest it; she never sends, approves or cancels an order.

Booking in what arrived does the rest: a stock line goes into its store at the order’s price, which becomes the part’s last price; a line for a job goes straight onto the job’s cost.

Photograph or upload the supplier’s bill on its order. Athena reads it twice and checks its net, tax and total against what arrived; a figure is trusted only when both reads agree. A person accepts the bill, and any difference is spread over the jobs and parts it was for.

Issuing work to a contractor hands them the job through their access to your records and records what you agreed to pay. They say accepted, on site and done; once they say done, a person accepts it and the value goes on the job.

A job’s bought cost is its parts (from stock at their last price, or bought for the job at the order’s price, trued up to the bill) and its accepted contractor orders.

Ask several suppliers to price the same thing by a closing time. Each supplier with an address on file gets its own link to send its quote; a quote that comes by phone is recorded by hand. Any supplier on your list can be asked; only an approved one with its documents in order can be awarded.

A sealed request keeps every quote’s figures locked away until the closing time, or until every supplier has answered: nobody sees them, Athena included, only that a quote came and when. Then a named person opens them. A quote that came after the closing time stays sealed unless the person opening them lets it in, with why.

Athena compares the opened quotes and recommends one: the lowest total from a supplier who can be awarded, then the quickest to deliver, with her reasons. A person always awards. Awarding to anyone else is fine; say why. The award becomes a draft order at the quoted prices, and the other suppliers are thanked.

A supplier’s bill is checked three ways: against the order (the price you agreed), against what arrived (and was not billed already) and against its own sums. If it agrees, it waits for a person to approve it for payment. If anything differs, it is held with what differs in plain words, and only a person clears it. Nothing is approved for payment by itself, ever.

If a bill agrees with what arrived, there is nothing to type but its number, date and totals: its lines are what arrived and is not yet billed, at the order’s prices. Type the lines only when the bill differs.

Paying less than a bill says, or taking a supplier’s credit note, lowers what you owe, so it waits for a second person. The person who asked cannot confirm it.

When a bill is approved for payment, what you owe that supplier goes onto the money ledger, due on the bill’s date plus their payment days, and the part of it bought for jobs goes onto those jobs’ costs once. Stock bought for the shelf costs a job only when it is used on it.

A blanket order agrees a value with one supplier up to a limit between two dates. It is approved on its limit and sent once. Each call-off against it is an order for what is on it, needs no approval of its own and is refused if it would go over what is left or falls outside the dates.

Keep each supplier’s price list or contract with the dates it is in force, and a lower price from a bigger quantity if they give one. A person puts it in force. An order line left unpriced then takes the price in force that day, and says it came from the list.

Record a supplier’s insurance and accreditations with their expiry, and say which ones each supplier must hold. A person verifies each one against the certificate. A supplier missing one, or with one unverified or run out, cannot be approved, sent orders, awarded quotes or issued work until it is put right. You see them running out 30 days ahead.

On time and right first time come from your own records: on time is the last delivery on or before the date the order was needed by; right first time is nothing turned away at goods in and every bill matching when it came. Each figure opens the orders behind it.

The buying queue is everything buying owes somebody now, in bands: bills that do not match, a second person needed, late deliveries, orders to place, bills to approve, quotes, requests, contractor work done, bills to come, supplier documents and price lists ending. Oldest first; nothing drops off until a person deals with it.

Report something is one button for seven things: an incident, a near miss, an unsafe condition, unsafe behaviour, a hazard, a positive observation and an improvement suggestion. Say or type what happened, add photos or a voice note, say where and when; it takes under a minute.

With no signal the report is kept on the phone, with the time you made it, and sent once when there is signal. The record keeps both times.

Report anonymously and your name is written nowhere: not on the record, not in the history, not in the audit trail. You get a follow-up code to read the reply. Anonymous reports need signal, so nothing that could name you is kept on the phone.

Every incident has a reference such as INC-26-0041: the year at the site and a count that starts again each January. Observations are OBS- and actions ACT-.

An incident is Reported until someone classifies it or sets its level, then Under review. While an investigation is open it is Investigating; while its actions are being worked on it is Actions in progress; when they are done and waiting for a check, Awaiting verification. Then a person closes it. A closed incident can be reopened with a reason.

Level 1 is first aid or minor damage; 2 medical treatment or moderate damage; 3 lost time, restricted work or significant damage; 4 a major injury or a dangerous occurrence; 5 a fatality. The level sets who reviews it: a supervisor at Level 1, then the responsible manager from Level 2, the safety lead from Level 3 and a director at Levels 4 and 5. From Level 2 an investigation is signed off before it closes.

The priority grid is how likely times how bad, 1 to 5 each: Low 1 to 4 (act within 90 days), Medium 5 to 9 (30 days), High 10 to 16 (7 days), Critical 20 to 25 (make safe now, act within 24 hours). A new action’s due date comes from its band.

Classifying says what kind it was, the outcome (fatality, lost time, restricted work, medical treatment, first aid, near miss, damage only, environmental or no injury, in the words of the site’s country), whether it is recordable and why, how bad it was and how bad it could have been, and whether it could have been serious or fatal.

Each site uses its country’s rules: the regulator’s name, what a regulator report is called and the outcome categories. The incident keeps the version of the rules it was classified under. The rules are marked “check” until someone qualified in that country has reviewed them.

Athena reads every new incident twice and writes its reading beside it: the kind, the outcome, how bad it was and could have been, a suggested level and up to two questions. When the two reads differ it says it is not sure. It never classifies, decides a regulator report or closes anything: a person does, and can use Athena’s reading with one tap.

At each change of status the person who reported it, everyone named in it, each of their line managers and the responsible manager are told. Anonymous reporters read the update with their code.

An incident cannot be closed while it is unclassified, its level is not set, recordable is not decided, the regulator decision is not made (or a regulator report has no reference), any action is still open or waiting for a check, a needed investigation is not signed off, a reviewer has not approved it, the reporter has not been told, or the closing comment is empty. The person who reported it, or anyone named in it, cannot close it.

The regulator decision is made by a person with the right to make it. If it must be reported, you send it yourself on the regulator’s own form and add their reference to the incident: the software never sends anything to a regulator for you.

An investigation has a lead (never someone named in the incident), a team, a target date, a method (5 whys, fishbone, timeline, barrier analysis or bow-tie), a timeline, findings and lessons. Causes are recorded as immediate causes, contributing factors and system root causes, and each can raise an action. The lead or the safety lead signs it off.

Record what an incident cost: time lost, labour, people (cover and overtime), equipment, medical and other costs such as fines or clean-up, each direct or indirect. Give the amount, or the hours and the rate. Costs can be added after it closes.

Every action from every report, investigation and inspection sits in one tracker with an owner, a due date from its priority, and evidence when it needs it. Someone other than the owner checks it. Moving a date needs a reason and the first date is kept.

The evidence pack is the whole incident as one PDF: what happened, people (only if you may see them), classification, reviews, the investigation, actions, costs, notices, every file with its SHA-256 and the full story of who did what and when. Who exported it is recorded.

Each incident is read against its site’s country rules as soon as it is reported and again whenever it changes: what must be sent, to whom and by when, counted in the site’s own time (days end at midnight there; working days skip weekends and public holidays). Each one shows on the incident and on Due to regulators, and the safety lead has it on Needs you until it is sent, decided not reportable, or set aside with a reason. An incident does not close while one is still open.

Athena’s Reportability Adviser says, beside your decision, whether the regulator must be told, under which rule, by when, and what else is due (an insurer’s notice, a compensation form). When something it needs is missing, such as the days off work, it says it cannot tell yet and asks. It never decides and never sends anything: you decide and send.

The regulator’s form is filled in order from the incident: the RIDDOR online report, the HSA’s IR1, WSIB’s Form 7, Cal/OSHA’s 5020, the OSHA 300 and 301. Copy each answer into the regulator’s own form, fill in what the record does not hold, send it yourself and add their reference to the incident.

Where the rules keep a log per establishment (the OSHA 300), each recordable case is on it with its column, its days away and on restriction (counted to 180), and its type. A privacy case shows “Privacy case” instead of the name. After the year ends, enter the average number of employees and the hours worked and a company executive certifies the 300A. The 300A summary and the case data come out as the CSV files OSHA’s Injury Tracking Application takes; you upload them.

A task risk assessment is called what your site’s country calls it: a JSA in the US, RAMS in the UK, a SWMS in Australia, a JHA in Canada. It is the same record everywhere: the job step by step, what could hurt someone at each step and the controls.

Type the job in one sentence and press Draft it. Athena writes the steps, the hazards and the controls, starting from your starter library when a task there fits, and says what it could not find. It always adds work at height, live electricity, confined spaces, hot work, vehicles, chemicals and heavy loads when the sentence names them. The draft is yours to change; Athena never approves it.

Controls are listed best first: remove the hazard, use something less dangerous, guard or isolate it, a safe way of working, then protective equipment. A hazard controlled by protective equipment alone is pointed out before approval.

The person who wrote a version sends it for approval; someone else approves it. It cannot be approved while a hazard has no control, no hazard is listed, or the emergency line is empty. Approving puts it in force, replaces the version before and starts the review clock (12 months unless you change it).

At the start of the shift, open it on your phone and press Start the sign-on. Pass the phone along: each person reads the key points, puts their name and signs on the screen. Contractors and visitors sign the same way. With no signal the signatures are kept on the phone and sent once when it comes back.

Each person signs each version once. When a new version is approved, everyone signs again, and the phone shows what changed first. A version that has been replaced cannot be signed. A signature is asked for again after 12 months even with no new version.

The starter library holds ready-written tasks for your sector. Use one and it becomes a draft here for you to fit to your site and send for approval.

Safety meetings holds your toolbox talks and safety meetings in one place: the topic library, what is booked, the talk being given now, who was there, the minutes and the actions raised.

Type a topic, or pick a recent incident, and press Draft it. Athena writes the points to say and a short quiz, starting from your starter talks when one fits. The draft is yours to change: nobody gives it until you save it as ready. Athena never gives a talk or signs for anyone.

When you start a talk, your phone shows a code. Each person scans it with their own phone (Scan, or the phone’s camera), takes the quiz and signs. With no signal their signature is kept on their phone and counted when it arrives, as long as it was signed while the talk was on.

People without the app, contractors and visitors sign on your phone instead: press Sign on this phone and pass it along. Each person puts their name, answers the quiz and signs on the screen.

Actions raised in a talk or a meeting go on the one action tracker with an owner and a due date, and the owner is told. Write the minutes on the same page.

When the talk is finished, the people it was booked for who did not sign are listed. Send them the talk as a briefing and each one acknowledges it on their phone.

A talk with no signatures 48 hours after it started shows as not evidenced. A talk given on paper is finished with a photo of the signed sheet.

Speak or type it: say what happened in your own words and your own language, in the app or by scanning a label with your phone’s camera (no login). Athena fills in the report and marks every line it filled; check each one, change what is wrong, then send it.

People can report in any language Athena reads. The report keeps their own words beside the English, marked "Translated by Athena", and anything said back to them goes in their language. The reporting page itself is in English, Spanish, Polish, Portuguese, French, Romanian and Arabic.

Each line Athena fills stays marked until the person who reported it presses Right or changes it, and Send waits for every line. If they never send it, it goes to the safety lead after 30 minutes anyway, marked "not checked by the reporter", so no report is lost. The incident shows which lines Athena filled and which ones the reporter changed.

At a label with no login, the report goes in without anyone’s name and the person gets a follow-up code to read the reply in their language.

Reporting by WhatsApp and by phone call is ready to switch on once a WhatsApp and phone provider is set up for your organisation. Messages about a safety report never cost credits.

Working alone: start a session, name two people, and check in when the phone asks. If you miss a check-in, the system texts and alerts those two people, and then whoever is on call and the safety lead. The server’s clock decides, so a phone with no signal is still watched.

This is not a 24-hour monitored service: the people alerted are your own team. If nobody answers, call emergency services yourself.

Before your first session the phone shows what will happen and checks its notifications, location, background running and battery settings. The countdown never starts until you have read it.

No signal? Press I’m OK anyway: the check-in is kept on the phone with its time and sent when the signal comes back. If it arrives after the check-in was missed, the people alerted are told you are safe.

Hold SOS for a second. It goes at once, by push and by text, to whoever is on call, then the people watching you. If nobody has it after a minute it goes again, wider. After 90 seconds the phone tells you to call emergency services. Only you can cancel your SOS; a supervisor resolves it once you are safe. Athena never acknowledges, cancels or resolves an SOS.

The risk assessment at the point of work is five questions: height, live or high-voltage electrics, a confined space, working alone, anything unusual. A yes to height, electrics or a confined space sets the level, and nothing answers it down. The level sets how often you check in.

On a break, press Break and say how long (up to an hour). The check-ins wait until the break ends; if you are not back by then, the people watching you are told, as for a missed check-in.

Leaving site alone? Press Heading home and give your arrival time. If you have not arrived by then, the people watching you are told that you have not arrived. Press Arrived to finish.

The lone-worker board shows everyone working alone, worst first: SOS, missed check-ins, overdue, silent phones, due soon, on a break, travelling. A supervisor who has spoken to someone can move their next check-in on by 15, 30, 60 or 120 minutes with a reason. “Spoken to, safe” is recorded but does not reset the clock.

A phone that reports in the background and goes quiet for ten minutes shows as silent on the board, before any check-in is missed. A low battery tells the people watching you once. Athena never checks in, moves a check-in on or stands a session down.

Every SOS opens an incident straight away, so the record exists whatever happens next. A man-down alert (the phone asked if you were all right and nobody answered) and a duress PIN (a silent alarm: the phone looks as if it checked in) are SOS alerts too.

Where your organisation lists words for intrusive work (drill, core, chase), a job that names one at a place with nothing on the asbestos register waits until you confirm you will treat the place as containing asbestos.

A place with asbestos on its register shows each entry before you start a job there. You confirm you have read them, and start work is refused until you do. An entry marked Stop needs the duty holder’s say-so, with their reason.

The questions people answer before they start are a question set. There is one for every job, and there can be one for a kind of work, a kind of equipment or a site. A set in use is never changed: a new version applies to new assessments only.

Some answers set the level and nothing answers them down: working at height, near anything live or in a confined space, bad weather, no signal. Some answers stop the job: missing protective equipment, faulty equipment, a reading over its limit. Then the job is held until a supervisor talks it through.

A held risk assessment tells your line manager and the safety lead. You cannot start working alone on it until a supervisor has talked it through with you and said go ahead. They can also stop the job. Athena never answers, releases or lowers a risk assessment.

On a job that carries on over several days, Same as yesterday shows yesterday’s answers. Change anything that is different; the floors and the stops are worked out again from every answer.

Anything else you type (for example "the ladder is wet" or "there is a gas smell") is matched to the fixed hazards: height, live electrics, confined spaces, hot work, vehicles, chemicals, heavy loads. A match raises the level.

Every task risk assessment in force has a review date. When it is due, or someone asks for a review (after an incident, say), a competent person reads it again: if it is still right, Reviewed starts the clock again; if anything must change, start a new version and get it approved. Athena never reviews or approves one.

A site can have its own copy of a default task risk assessment, under its own country’s word. When the default gets a new version, every site copy is asked for a review, so the two never drift apart unnoticed.

Athena reads each task risk assessment sent for approval, and each contractor’s, and lists what is missing beside it: a hazard the job names but nothing covers, work at height with no rescue plan, electrical work with no isolation, a confined space with no permit, gas test or rescue, hot work with no permit or fire watch, or someone working alone where the site does not allow it. A person decides.

A contractor’s RAMS is taken in for review and read against this site’s rules at once. Someone other than the person who took it in approves it; anything that blocks it must be fixed first. Return it with comments, or reject it with the reason. A resubmission shows what changed since the one returned.

An incident goes on legal hold by itself when it was high or critical, could have been serious or fatal, or a regulator must be told. A held incident and its records are kept as they are and it cannot be cancelled. Only a person lifts the hold, with the reason; the rules never put it back once a person has lifted it.

Make the regulator’s form from the incident: the fields come in the regulator’s order, filled from the record, with blanks for what the record does not hold. Every line is marked check. You send it yourself, then record the reference the regulator gives you: that is what stops the clock. Athena never sends or files a regulator report.

Who must report: we report injuries to our own people. A contractor’s or agency worker’s employer reports theirs, so tell them the same day. For anyone not at work for us (a visitor, a member of the public) we report as the people in control of the place, if the rules need it. Every line is check until someone qualified in that country has reviewed it.

Athena can draft an incident’s timeline from its own records (the report, the risk assessment, the lone-worker session, the SOS, the job and its permits, the statements and photos), every line showing the record it came from, and the possible causes those records and the statements show, each with its evidence. The lead decides every cause and signs the investigation. Athena never closes, signs or blames anyone.

If you work for clients who use Predict & Maintain, send your approved task risk assessment to them from here: pick the clients and their sites, and each one gets its own copy of the version in force. You see what each client did with it. Send it again after changes and they see what changed. They only see what you send.

Contractors who work for you can send their RAMS from their own Predict & Maintain. It waits here until someone takes it in; then it is read against this site’s rules and decided like any contractor’s RAMS, by someone other than the person who took it in.

Download a task risk assessment as a PDF with a sign-on sheet at the back. The sheet’s code opens the sign-on for that exact version on a phone; anyone without a phone signs the sheet. A printed copy can go out of date, so the phone always shows the version in force.

Contractors’ people working alone on your sites show here when their company runs the job in its own Predict & Maintain: who, which company, how their check-ins stand and which site, never where they are. Say who watches them: the company, you, or both.

Where a site’s rules have yearly duties (in the US, the 300A summary certified by an executive, posted from 1 February to 30 April, and for some establishments the year’s data sent electronically by 2 March), each shows as a clock. Record when it was certified, posted and sent. Every rule is marked check until someone qualified in that country has reviewed it.

When a regulator deadline is under 24 hours away and nothing is recorded as sent, the safety lead is told. If it is still open with six hours left, the site manager (or the owners) are told too. Each is told once.

A duty is one thing the law, a regulator, an insurer, a contract or your own policy asks for. Adopt it from the library and it keeps its citation, how often, what proves it and how hard the interval is.

Library duties marked “check” were drafted from public sources and have not yet been checked against the current edition by a named person. The mark stays on every screen until someone checks it; the Brain can never remove it.

Each duty says which nations it applies in. A duty for England cannot be put on a site in Scotland: set the site’s nation and the right row is used.

An obligation is one duty on one asset or place. Each pair exists once, with its state worked out by the server from the certificates, the linked work and the dates.

Compliant: a satisfying certificate on file and inside its date. Due soon: inside the warning window. Overdue: past the legal latest. Non-compliant: the last certificate failed, is missing something, or the work was done by someone not competent. Overdue, mitigation approved: not compliance, and counted as non-compliant. Not applicable: declared, with a reason. Unknown: nothing on file, never counted as compliant.

Work alone never turns an obligation green. When the linked work is done and the certificate is not in yet, it shows “done, awaiting evidence” until the certificate arrives.

Some duties fall due because something happened: moving a lift to a new site makes its examination due that day. A retired asset’s obligations end and keep their history.

Add a certificate against the obligations it proves. It is checked against what that kind of certificate must contain; one that is missing something never satisfies an obligation unless a named person accepts it with a reason.

A certificate for a statutory duty counts once someone other than the person who added it has verified it. You can switch the second person off in the compliance settings.

When the date on a certificate and the duty’s rule disagree, the rule sets the legal latest; the certificate’s own date is kept and shown.

A duty can be made stricter at any time: a shorter interval, records kept longer. Making an interval longer needs a risk assessment and the duty holder’s signature, and is refused outright for an interval fixed in law.

Declaring an obligation not applicable is a person’s decision with a reason. It shows as declared, never as deleted, and can be withdrawn.

A requirement says who or what must hold which certificate, for example to do the work or to enter a site. Each holder shows held, expiring, expired, deficient or missing, and every page reads the same answer.

Planned maintenance, work orders and the planning board read the legal latest and which duty a job evidences from here, so a statutory job shows its duty wherever it appears.

Map my duties looks at your sites, the nation each is in and the kinds of equipment you have, and proposes the duties from the library that apply, with the assets and places each covers. Nothing is adopted until you apply it; each obligation starts as Unknown, nothing on file.

Every duty in the library says “basis unverified” until a named person on our side checks it against the current edition of the law or standard. A British Standard is shown as a standard, never as law.

Name a duty holder for each duty. The nightly check tells them when something falls due with nothing booked, goes overdue or fails, and passes it to the compliance lead after a week.

Drop or photograph a certificate and Athena reads it twice, with two different models. A date or an outcome is filled in only when both reads agree; otherwise you type it from the certificate. You always say the outcome yourself.

A statutory certificate you file counts once someone else in the workspace verifies it. Until then the obligation keeps its old state, so no date is trusted on one person’s word.

The matrix shows each site against each duty family: green compliant, amber due soon, red overdue or failed, grey unknown. Unknown means nothing on file and is never counted as compliant. Big Six and Building safety are ready-made views.

The calendar shows what falls due by its legal latest date, week by week, against what is booked. Book unbooked raises a job for every obligation in view with nothing booked.

Reminders about obligations go only to people in your workspace. Nothing is sent to a contractor or anyone outside it.

Find the gaps lists every obligation with nothing on file, with the kind of certificate that would prove it.

Schedule an inspection once: which form, where, who does it, how often and from when. Each one appears on that person’s Today the day before it is due (or as many days before as you set), with a reminder, and is marked overdue if the day passes.

A due inspection is done the moment it is sent, from any phone. Its score and its failed items show on the schedule, and each failed item is already an action on the tracker.

Notices keeps every statutory notice with its own clock: the copies residents must get (a gas safety record within 28 days of the check, an electrical report, the written summary after a damp and mould investigation) and the notices a regulator serves on you, with the compliance date and the appeal window.

When a gas safety record or an electrical report for a home is filed, the copy for the resident is drafted for you with its due date. A person checks the words and serves it; it is never sent by text alone, and a letter is the fallback when email cannot be used.

Each kind of notice names its regulator from the pack for the site’s nation. Every kind says “check” until a named person has checked the current law.

Athena can draft a notice for you and read a regulator’s letter into the fields. Serving a notice, recording an appeal or that you complied, and closing a notice are always a person’s acts.

The Tenant Satisfaction Measures’ building-safety set (BS01 gas, BS02 fire, BS03 asbestos, BS04 water, BS05 lifts) is counted from your obligations and certificates as at 31 March: homes, buildings or lifts whose checks were all carried out, out of those that need them. Each figure lists the ones not met and the ones left out, with the reason.

The social housing pack adds smoke and carbon monoxide alarms for each nation, the five-yearly electrical report in social homes, communal fire doors every three months and flat entrance doors every year in buildings over 11 metres, and fire safety information to residents. The schools pack adds fume cupboards, workshop extraction, lab gas interlocks, PE equipment, workshop machines and pools.

Findings lists every defect a certificate, an inspection or a notice raised, with its grade, the date it must be put right by, the person tracking it and the job that fixes it. The scheme’s own code (C1, C2, FI) is kept exactly as written.

Each grade has a longest time to put it right. You can bring a date forward with a reason; a later date needs an approved mitigation, never a quiet change.

A finding is closed by a person with the evidence: the finished job, a photo, or the certificate from the retest. An immediate danger closes only with a satisfactory retest certificate or the competent person’s signed statement. Athena can raise a finding; it never closes one.

An evidence pack is put together from the records you already hold, for one duty, one site and a period: each certificate, job, finding, notice and obligation with its fingerprint (SHA-256), and what is missing listed at the top. Nothing is typed in.

A person seals and signs a pack as a true extract of the records on the day. If anything changed since it was put together, put it together again first. A sealed pack never changes; Check it compares it with the records today and lists what changed, was added or has gone.

The register counts what is done, due and missing by nation and by the regulator the library names for each duty. Not applicable is left out; overdue with a mitigation still counts as missing.

A certificate issued from a passed form files itself against the duties it proves on that equipment or place, and each finding it was passed with is raised as a finding.

Athena writes a narrative beside a draft pack: where things stand, what happened in the period, every gap in its own sentence and what was done about it. Every sentence shows the numbers of the items it rests on. A sentence she could not cite is marked, and the pack is not sealed with it.

When you seal a pack with a narrative beside it, the seal covers the narrative too: its fingerprint is part of the seal. You can seal the pack without the narrative; then the narrative is not part of what you signed.

Download a pack as a PDF, or as a ZIP with the PDF, manifest.json (every fingerprint, for checking later) and the original files the pack’s certificates and closed findings rest on.

Share a sealed pack by link: name who it is for, how many days it works (up to 90), or one visit (it stops an hour after it is first opened). The link is shown once, or emailed once. Every time it is opened is kept, and you can stop a link working at any time. A draft is never shared.

Regulatory watch lists the regulators’ sources you follow and every change they published, newest first, with the duties each one may touch. Regulators come from your jurisdiction pack.

Athena reads each change and suggests which of your duties it may touch and what to look at. It is a suggestion: Athena never changes a duty, and every legal fact stays marked check until the named reviewer signs.

A person decides what a change means (no change, change a duty, add one, retire one, or keep watching) and names the reviewer. The named, qualified reviewer then signs it or sends it back; it is never the same person. A signed decision never changes.

After a decision is signed, change the duty on its own page. Nothing changes a duty by itself.

A standard’s text is licensed, so only its title and date are kept. A source whose terms forbid automatic reading is never fetched: it shows check by hand. A source not read for 30 days shows stale.

Name the people qualified to sign regulation decisions, with what qualifies them and the jurisdictions they cover.

Everyone the work touches has a person record, with or without a login: a contractor’s labourer or a visiting engineer can be planned, inducted and have hours recorded without ever signing in.

A person with a login is linked to their membership of the workspace. One login is one person here; their roles and what they can open are set in Settings.

Everyone in the workspace sees the directory: names, teams, job titles, work phone and email. Private numbers and emergency contacts are seen only by those allowed, and every look is recorded.

Adding someone whose work email is already used is refused. A name that is already here asks whether it is someone else before adding them.

Import a spreadsheet of people: rows that check out are added, every other row is listed with why it was skipped (no name, an email that is not one, a team that does not exist, someone already here).

Teams can sit inside teams. A team marked “planned as one crew” can be given work as one on the plan. Taking someone out of a team ends their membership on a date; nothing is deleted.

A shift pattern is a week: the shift on each day and its break, or a rest day. Everyone starts on Days, Monday to Friday 08:00 to 16:30, unless they are put on another. A night shift belongs to the day it starts.

Patterns can be written in words, such as “Nights, Mon–Thu 22:00–06:00” or “weekends 7am to 7pm, 60 min break”. Patterns longer than a week, such as four on four off, come with the full pattern editor.

The hours the plan can use each day are the shift less its break, times the share free for planned work (75% unless the pattern says otherwise), less any absence. A morning or afternoon off halves the day.

Putting someone on a new pattern applies from a date, never to days already worked, and it changes their hours, so Athena can only ask first.

The skill library lists each skill once with its levels, how long it lasts and which trade’s work needs it. Starter skills can be added in one go and changed afterwards.

A competency counts once there is evidence: a person records it, usually from a checked certificate, and it expires on the certificate’s date or after the skill’s validity. Skills added with a new person wait for evidence.

A photo or PDF of a certificate is uploaded with its dates; a second person checks it against the photo. Nobody checks their own certificate or records their own competency, and Athena never does either.

When work is planned, the plan checks the person holds the skills that trade’s work needs, at the level, on the day. For now a gap is a warning beside the job, not a block.

A supervisor records leave, sickness or training for someone, whole days or half a day, and the plan stops counting those hours at once. Leave requests and balances come next.

Marking someone as left sets their last day; their teams and pattern end with it and their records are kept. Taking their login away is done in Settings.

A job role, such as forklift driver or first aider, lists the training it needs. Putting someone in a role, at one site or wherever they work, adds what the role needs to their row of the matrix from that day.

Training can be needed by everyone, by a job role, by everyone working at a site, or by a role at one site, at a level if it matters. Each says how many days before it runs out the person and their manager are told: 30 unless you set another number.

Who is missing what lists everyone who needs a certificate they do not hold, has let expire, has not had checked yet, or will soon lose, with the site it is needed at. Filter by several roles, sites, certificates and states at once.

Photograph a certificate, or upload its PDF, and Athena reads the name, what it is, who issued it, its number and its dates. It reads twice and only trusts a date both reads agree on; any other date you type. It never fills in what the certificate does not show.

What Athena read goes onto the certificate only when someone confirms it, the holder or whoever uploaded it. If the name on it is not the person’s, say it is theirs first. A second person then checks it against the photo before it counts.

Before training runs out, the person and their line manager each get a reminder on their Today page and by push or email, once. If it runs out, they are told again. Renewing it closes the reminders.

The rota is drafted from each person’s shift pattern for a period and stays a draft, seen only by those who edit it, until someone publishes it. Days that already have a shift, and whole days off, are left as they are.

On call is a layer of the same rota: who, which tier, one site or every site, from when to when. Only published slots count: an escalation or an SOS reaches whoever is on a published slot then, tier 1 first, and never someone off on approved leave.

Each morning the next seven days are checked for times nobody is on call, and the people who edit the rota get a card for each gap. Athena can suggest who could cover it, fairly; a person always puts them on and publishes.

Publishing changes people’s hours, so only a person can do it. Athena can draft and suggest shifts and slots, never publish them.

Ask for leave on your phone: the days it takes are counted from your shift pattern, and you see what is left this leave year. Your line manager or team lead approves it, or declines it with a reason. Nobody decides their own.

A balance is the year’s entitlement plus days carried in, less leave taken and booked. Entitlements are set per person per leave year; until one is set, the kind of leave’s full-time figure is used. Check it against your contracts.

Your balance and your hours are yours: you see them, and so do your line manager, your team lead and whoever is allowed to see everyone’s. Nobody else does.

The authorisations register says who may do which safety-critical work, where and until when: Authorised Person, permit issuer, confined space entry and the rest. Each rests on a checked certificate and, where the kind says, a current competence.

An authorisation counts only when it is current, in date, for the site, and its certificate is checked and in date. Anything missing, expired, suspended or unreadable means no: a site with no in-date holder has nobody who can do that work there.

Authorisations are appointed one person at a time, with a certificate, an expiry and a reason. Nobody appoints themselves, and Athena never appoints, suspends or revokes anyone. A suspension counts from the next check.

Thirty days before an authorisation runs out, the holder, their manager and the safety leads get a card on their Today, and again once it has run out.

Your week is written from what was recorded: your check-ins, or on a day without one your job hours, your approved leave, your on-call and, on a day with nothing else, your published shift. Every block says where it came from.

Confirm is the one word for agreeing your own hours, and only you can confirm your week. After that a block never changes: a correction is a new block, and your manager approves the week or sends it back with a question.

Check in on your phone when you start and check out when you stop. A week cannot be confirmed while you are still checked in.

Each site can have its induction: who must take it (everyone, staff or contractors), what it says one screen at a time, the words each person signs, and how many months it lasts. Publishing a new version asks everyone again; the earlier version stays good for its grace days.

A person takes an induction on their phone and signs for it, or the person who gave it records it in person or after a phone call. Each record keeps the version and exactly what they were shown. Athena can draft an induction; it never records one as taken.

A job does not start, a permit is not accepted and “I’m here” is not recorded at a site until the person has the site’s induction in date, and for a job the skills its trade needs. The reason is said in words. Nothing needed means nothing missing.

A supervisor can let one person past the job or site gate once, at one site and for a few hours, with the reason and what was missing recorded. A permit gate, a missing authorisation and an unknown person are never bypassed, and nobody bypasses for themselves.

In People settings the job and site gates can be soft: the person is warned and goes on. Accepting a permit is always a hard gate.

An induction can end with a few check questions and a pass mark. The questions and right answers are part of the version, so changing them is a new version. Not passed, nothing is recorded and the person is told which questions to read again; passed, the answers and the score are kept on their record.

A site’s shared screen at the gate or reception can take its induction one person after another: each reads it, answers the questions and signs with their own login for that one act. The screen stays as it was and keeps nothing of theirs; the record says it was taken on a shared screen.

An approved week is costed once onto the money ledger at each person’s own rate, else the rate for that kind of hour. Hours on a job are already on the job at the normal rate, so the week adds only their overtime or weekend premium; hours that are not on a job carry their whole cost.

The pay rule says when overtime starts in a week and the weekend rate. Overtime falls on the last hours of the week. Without an overtime rate it is the normal rate times the multiplier. A kind of hour with no rate is left unpriced and said, never costed at nothing.

The payroll file gives hours, not money, for each person and approved week: worked, overtime, weekend, travel, call-out and on call. Your payroll applies its own pay rates.

Time off in lieu is banked from an approved week’s overtime, before the week is costed, by the person’s manager; never more than that week’s overtime. Time taken comes off the balance, which never goes below nothing.

Your standing rule says which weeks are clean: confirmed by the person, every check passed, under the hours you set, and (unless you allow it) no lines typed by hand. Approve all clean approves those in one press and lists them; the rest wait for you to open.

An agency’s or contractor’s invoice for hours is matched line by line to the hours you approved for their people in that period, and to their rate card. One that does not match is approved only with a reason, or disputed.

My day on the phone has chips along the top: Mine (your stops in order), Available (jobs nobody has yet), Drafts (what you started and did not send), To sign (sign-offs waiting) and Team for supervisors. Cards below show only what applies to you.

Scan opens the camera and reads QR codes and barcodes on assets, places and job sheets. It opens what the tag is on and offers what fits: open it, raise a problem, take a photo or sign. If the camera is off or the tag is worn, type the code instead.

Tags made by the workspace carry a check only it can make, so a sticker put over a real tag is spotted: the phone says it is not from your workspace and offers to report it. Anything else a code says is shown as text, never opened as a link.

With no signal, a tag for something already on the phone opens straight away. A tag the phone does not hold yet waits and opens when there is signal.

Photos taken in the app are kept in the app, never in your own photo library. Each is saved on the phone first and sent when there is signal; it only counts as sent once the server has exactly the same picture.

A signature is drawn on the screen with the signer’s name and what they are signing. It is kept as evidence on the job with the time, and with where it was signed when the workspace records that.

When the workspace asks, the phone records where a photo or signature was taken, with how accurate the fix was. It is kept beside the evidence, never inside the picture, and never taken when you are not doing a job.

Job alerts come as notifications on the phone once you allow them. On an iPhone the app has to be on the Home Screen first. Until notifications work, new and moved jobs come to you by email instead.

The app asks for the camera, location or notifications only when you first need them, with one line saying why. If you said no, This phone shows the steps to change it, and the job carries on without it.

While a job is open the screen stays on, so it does not lock in the middle of a task. It lets go when the battery is low or you leave the job.

This phone shows what is waiting to be sent, which permissions are on, whether alerts work (with a test), the app version, and a way to save unsent work as a sealed file only support can open.

The Predict & Maintain app from the App Store or Google Play is the same app as in the browser, with more: alerts that arrive like texts, face or fingerprint unlock, and opening with no signal. Nothing is bought in the app.

The first screen of the store app has three ways in: sign in, enter an invite code, or, if your organisation is new, get a link to set it up on the website. Set-up and anything to pay for happen on the website, never in the app.

A PIN of at least six numbers unlocks the app on this phone when face or fingerprint cannot be used, in gloves or a mask. After too many wrong tries the phone clears its saved records; work not yet sent is kept and sent when you sign in again.

Face or fingerprint unlock opens the app on this phone only; it is not your sign-in. If the faces or fingerprints on the phone change, the app asks for your PIN once and you can turn face or fingerprint back on.

With no signal the app still opens, after your PIN or face or fingerprint, for as many days since it last reached the server as your organisation allows. Work done then is sent and checked when there is signal.

The app updates itself in the background and never in the middle of a job: it waits for the job to finish, and for unsent work to be sent when the new version needs it. With no signal it keeps working on the version it has.

What your organisation can see shows exactly what the app does on your phone: location only during a lone-worker session, an SOS or evidence your organisation asks for; photos kept in the app; no contacts or messages read; wipe removes only the app.

A practice job is a real job on your phone, marked PRACTICE, that counts for nothing: try every step (travel, arrive, start, a reading, a photo, a note, a signature, complete). Only you and your supervisor see it.

In the store app, job alerts come from the phone itself (Apple or Google notifications), so they arrive even when the app is closed. Turn them on from This phone, and send yourself a test.

The app may ask once in a while, after a finished job, whether you would rate it in the store. It never asks during a safety task or on the sign-in screen.

In the store app your lone-worker countdown is set as alarms on the phone itself: five minutes before, when due, and when it is missed, even with the app closed. In a browser the phone cannot alert you with the browser closed, so keep the page open; the server still tells your people if you miss a check-in.

SOS alerts, missed check-ins and lapsed permits come through as critical alerts in the store app: they sound even with the phone on silent or Do Not Disturb, where the phone allows it.

No data signal when you hold SOS? It is kept and sent the moment the signal returns, and the phone offers to text the people on call straight away from its own messages app.

Hold the SOS button for a second to raise an SOS. It goes at once to whoever is on call, then to the people watching your lone-worker session, by push and by text. The screen then says who has it, gives the emergency number to call, and shows where you are so you can read it out.

With no signal the SOS is kept on the phone and goes the moment there is signal, tried again every few seconds. Send SOS by text opens your text app with the message and the numbers of the people on call already filled in.

While your SOS is live, the phone sends where you are every 30 seconds, and you can add a photo. If the phone has no location fix, the SOS still goes; it just says so.

Only you can cancel your own SOS, by holding Cancel for 30 seconds and then giving your PIN. If you set a duress PIN, giving it instead seems to cancel the SOS but sends a silent alarm to the people helping you.

Permits on the phone are in four lanes: Mine (you are in charge or in the working party), To issue (a request waits for you), Live on my sites, and Isolations. Each shows its time left and who it waits for.

With no signal the phone shows its last copy of a permit with the time it was checked, and says it may have changed. Nothing is signed from an old copy: issuing, accepting, resuming and handing back wait for signal, because the server checks who may sign and what clashes at that moment.

You can draft a permit with no signal. It is kept on the phone with a number ending in OFF, such as PTW-HW-OFF-K3F9-0001, until it is requested. Request issue waits for signal, because the issuer must see the same draft; then the permit gets its real number, and the OFF number still finds it.

With no signal, locking off a point is kept on the phone with the time you did it and goes the moment there is signal. The three prove-dead steps and your hand-back ticks are kept with their times too. Recording it proved dead, verifying or removing an isolation, handing back and every signature wait for signal.

On a shared device you can switch in with no signal once you have had a turn on it with signal, within your organisation’s offline days. Nothing is signed in a turn begun with no signal; your work waits, kept as yours, and goes when you type your PIN again with signal.

A shared tablet or phone carries several people in turn. Tap your badge or your name, then give your PIN: everything you do is recorded as you. When you switch, lock or leave it idle, your jobs, drafts and unsent work are locked away from the next person and go when you are back.

Your PIN for shared devices is at least 6 numbers, with no runs like 1234 and nothing repeated three times. Five wrong tries lock the PIN pad for 15 minutes. Set or change it on This phone.

If your organisation locks a shared device on the devices page, nobody can switch in until it is unlocked. If it is wiped, the device clears every person’s records and starts again; work not yet sent is kept to be sent.

Look a tool or instrument up on the phone by the tag or serial on it, its register number, or by scanning its label. It shows whether it is good to use now; if it is not, it names the one in date at the same site to use instead.

Take it puts the thing in your name, and Hand it back puts it back where it is kept. A thing that is stopped, overdue or not known to be good cannot be taken.

Photograph a lab’s calibration certificate on the instrument’s page and it is read twice. You check what was read against the certificate, pick the result yourself, and accept it or discard it with why. It then waits for someone to approve it.

Amounts are kept in your workspace’s own currency, to the penny or cent, and shown the way your country writes them. An amount nobody has entered shows a dash and is listed as unpriced; it is never counted as zero.

Amounts in different currencies are never added together. Until exchange rates arrive, an amount in another currency is kept as it was given and can only be approved by someone with no limit.

One person approves each request: someone whose approval limit covers it, never the person who asked. That rule cannot be switched off.

Pressing Approve checks your limit again at that moment, so a limit or a delegation that has changed since the request arrived counts as it is now.

Athena can ask for an approval and write a short brief for the person deciding. It never approves, declines or changes a limit.

An approval limit is set for a role or a named person, for one kind of decision, optionally only at some sites. It comes into force when a second person confirms it, and nobody confirms their own.

Going away? Hand your approval authority to someone for set dates and kinds of decision. It can never go above your own limit, and it is checked against your limit again each time it is used.

Declining or sending back needs a reason, so the person who asked knows what to change. Every decision is kept as it was made and cannot be edited.

Tax codes start from your country’s rates, each marked to check until you confirm it. A rate change is a new code from a date: documents already issued keep the rate they were issued with.

Invoices and credit notes are numbered in order with no gaps when they are issued. Drafts have no number, and a phone without signal never shows one.

Every job has one switch: Chargeable or not. It starts from the contract that covers the site, with the reason; planned maintenance under a contract is included. Not chargeable for any other reason needs a few words, so nobody waives a charge by accident.

Your rate card has labour, labour out of hours, a call-out fee, mileage and a parts mark-up. A change starts from a date as a new version; work done before then is still priced at the old rates.

A quote can be typed or filled in from a job. Once sent, that version never changes: changing it makes a new version with its own link. The customer accepts one version, by its link or by signing on your phone on site, with their name and order number.

Ready to bill gathers last month’s finished chargeable jobs and your contracts’ fixed fees and drafts one invoice per customer (or one per job, if that customer is billed per job). Each job and each fee period is billed once.

A line with no price shows a dash and is counted as unpriced, never as zero. An invoice with an unpriced line cannot be issued until you give it a price.

Issuing checks the invoice first: who it goes to, their order number if they need one, a price and a tax code on every line, nothing billed twice. Then it gets the next number, is emailed with a link and a PDF, and shows in the customer’s own view if they have access.

Invoices and credit notes are numbered in order with no gaps when they are issued. An issued invoice never changes: to correct one, credit it (all, some lines or an amount) and bill again.

If a customer tells you they are not the end user, tick reverse charge on their account and their invoices use your reverse charge tax code with its wording. A code with legal wording is used only once your accountant has confirmed it.

One polite reminder goes by itself a few days after an invoice is due, unless it is paid, credited, in the customer’s pay run, or reminders are off for that customer. You can send it sooner yourself.

Record a payment when it arrives and put it against one or more invoices; anything left over stays as the customer’s credit. A payment recorded wrongly is reversed, never deleted. With Xero or QuickBooks connected, invoices paid there show as paid here by themselves.

Connect Xero or QuickBooks Online and every invoice, credit note and customer you issue is sent there by itself, so nobody types it twice. Nothing in your accounts is changed by us except adding what you issued.

New bank details for your invoices wait for a second person to confirm them, and print only 24 hours after that. Everyone who handles money can see that they changed.

A budget is one figure for a site or a cost centre for the year, with a bar of what is spent and the day it will run out at this year’s pace. The forecast is shown as a forecast; it is never added to what is spent.

A contract holds the customer, the dates, the sites it covers, its fixed fee and whether reactive work is included. Its fee is billed from Ready to bill every period, in advance or in arrears, with a part period worked out by days.

A customer whose people you let in sees the invoices you issued them, what is still to pay, and the reports you sent, through their own access and nothing else. Your rates, costs and notes are never in it.

Athena can prepare quotes and draft invoices. A person sends every quote and issues every invoice; Athena never accepts a quote, issues a credit note, records or approves a payment, or changes a rate, a budget or bank details.

Add each purchase order a customer gives you, with what it is for and how much it covers before tax. What is used is worked out from the invoices that name it; drafts count too, so two invoices never use the same money.

An invoice above what is left on its PO, or after the PO has ended, is stopped before it goes, with the amount in words. A person with the right to can let one through with a reason. At 80% used you are told, so you can ask for more in time.

Ask for more on a PO sends the customer a short email with the amount needed and what it is for. It is sent once you press it.

Issued invoices, credit notes and customers go to your accounting system, and what is paid there comes back here. Changes made there, like a voided invoice or a new contact email, are listed for you to settle; nothing here changes by itself.

Match each of your tax codes and kinds of cost to your accounting system’s own. Once you match one, every invoice waits until all its codes are matched, so nothing lands in the wrong place.

Close a month when its work is billed, its drafts issued and everything has reached your accounting system. Its costs then go there as one journal, and no more costs can be put in that month. Reopening needs a second person and a reason.

Switch on “a draft invoice is approved by a second person before it is issued” in Money settings and every draft waits for someone else’s Approve before Issue works; the approver never issues it themselves. Any change to the lines takes the approval off.

Hold a draft with a reason and it is not issued until a person releases it. Each invoice line can carry the customer’s own reference (their order line, cost code or site), printed beside the line.

When a customer disputes an invoice, record it with their reason: the reminder and the chasing notices stop until a person settles it as withdrawn, credited or paid. Crediting is still a credit note a person issues.

What is still owed on an invoice can be written off with a reason by someone other than the person who issued it. A written-off invoice is never chased or owed again; the amount shows on the month’s controls review.

Send a statement from a customer’s page: what is open and overdue, and what they paid in the last 90 days, to their invoices address. Athena may ask to send one; you press it.

After the one polite reminder, three more notices can go by themselves at the days you set (second reminder, third reminder, final notice), each once, never while a dispute is open or the invoice is in the customer’s pay run. Switch it on in Money settings; a person can send the next notice any time an invoice is overdue.

The month’s controls review on Close a month counts what a reviewer asks about: invoices issued without an approval while the rule is on, approved and issued by the same person, billed past a PO, written off, credited, in dispute, payments reversed and months reopened.

Each morning Athena drafts last month’s invoice for each customer with work ready, and drafts a request for more on a PO that will not cover it. You check and press each one. Athena never issues an invoice.

At the end of a month, press Propose on the close page and the app lists what was received on an order with no bill yet, and contractor work accepted with no bill yet, with the order or the work as evidence. Accept each one, change its amount and say why, or turn it down. An accepted one goes on the last day of the month and comes off on the first day of the next, so the real bill lands without counting twice.

When a month is closed the value of each store is kept as it was that day. A stock movement from a phone that syncs after its month is closed is counted in the open month, and the close page says how many and which month they belong to. Nothing is lost.

Photograph or upload a customer’s purchase order and Athena reads it twice: its number, dates, value and what it covers. Anything the two reads disagree on is marked for you to type. You check it and add it as the customer’s PO; Athena never adds or changes a PO, approves an invoice or records a payment.

On Customer POs, press Read their PO document, choose the customer and take a photo or pick the PDF. When Athena has read it, only the values both reads agreed on are filled in; type the rest from the document, then press Add the PO. If the PO has writing that tries to give instructions, you see it as a warning: nothing is done because of it. Put it aside if it is not wanted.

Photograph or upload a utility bill and Athena reads it twice, with two different models. A figure is filled in only when both reads give the same; anything they disagree on is left for you to type.

A bill counts in your energy use and carbon only when a person accepts it. Athena never accepts a bill, and never changes a figure you typed.

Every bill is checked before it is accepted: that it adds up, that it is not billed twice, that it does not overlap or leave a gap with the last bill on the supply, that the units times the unit rate and the standing charge come to the net, and whether the read was estimated. A failed check needs a reason before the bill is accepted.

A supply is one meter point at a site: electricity, gas, heating oil, LPG or water, with its number as the supplier writes it. Add each supply once; bills are matched to it by that number.

Scope 1 is gas, heating oil and LPG burned on site; scope 2 is grid electricity, location-based. Each accepted bill gives one line: the units used times the published factor for that fuel, country and year. A bill that spans two years is shared between them by days. Market-based scope 2 and scope 3 come later.

Emission factors come from published tables: the UK government’s conversion factors and the US EPA’s factors. Every figure shows its publisher, table and year, and is marked check until someone compares it with the published table. When a year’s table is not loaded yet, the last one stands in and the figure says provisional.

Reading a bill uses credits: one bill read twice, the same as reading a certificate.

Interval data is a supply’s use every half-hour (or 15 minutes, or hour), from a meter data feed or a file you import. A missing interval is shown as a gap, never filled in; an estimate from the provider is marked as one.

A meter’s data feed is connected by a person, with the consent it rests on: who agreed, how, and until when. When the consent ends, nothing more is read until a person records the new date.

Import a file with one reading per line (time, kWh, and A or E), or one day per line (the date, then each half-hour). Days are read in the site’s time zone: the day the clocks go forward has 46 half-hours and the day they go back has 50. Any line that cannot be read is listed with why.

From the half-hours we work out the night-time use (01:00 to 05:00), the peak, how even the use is, how much is outside 07:00 to 19:00 on weekdays, and weekdays against weekends. Night-time use rising by a fifth on the four weeks before is pointed out: something is usually being left on.

A measured reading is never replaced by an estimate. An estimate gives way to the measured reading when it arrives.

A round is a walk with stops: cleaning, a patrol, readings or an operator round. Describe it in a sentence or add the stops one by one, each with what to do there: a task, a yes or no, or a reading with its limits. Say the days and times it is due and how long the window is.

Each stop asks for proof: scanning its tag (grade B) or its label (C), the phone’s position near it (D), or a tap (E). Scanning a label that is not the stop’s is refused, because it shows you were somewhere else.

A reading outside its limits, a check answered no, a task not done or a stop not visited is an exception on the run. A supervisor sends it on as a job, or closes it with why. A run with none is a clean run.

A run nobody started by the end of its window and its tolerance is missed. One started and not finished an hour after that is not finished. Both show on the live board.

A specification lists what is done where, how often and the time each takes. The hours a week and the cost are worked out from those, at the workspace’s normal labour rate unless the specification names its own, plus consumables. With no rate the hours are given and the cost is left unpriced.

Link a specification to its contract and record the client’s agreement: who agreed, how and on which day. An agreed version is frozen; a change is a new version, and the agreed one stays in force until the new one is agreed.

A zone is part of a site you clean or look after (offices, washrooms, a ward, the car park), with its size and the specification that covers it.

The daily sheet lists what the agreed specification says is due today, from how many times a week each task is done, and the rounds done and missed. A supervisor signs it, saying why anything was not done.

A performance term says what is measured (missed checkpoints, late rounds, or a figure from elsewhere), when a month fails, and the deduction. Each month is assessed by code from the rounds; a person agrees or disputes a failure.

Once Money closes a month, no daily sheet, assessment or service log is recorded into it.

Pest control visits (with whether activity was found), waste collections (stream, how much and the transfer note) and grounds tasks are logged as they were done; the waste totals add up by stream.

A register is a list of things you must keep track of: instruments to calibrate, ladders to inspect, keys to hand out. Each register has its own details, how often things are due and whether they are handed out. Switch on calibration, or set up one of your own.

The status of each thing is worked out by the system from its dates, its stops and who has it, never typed. A thing with no record is unknown, not in date. Every change of status is kept with why and who or what moved it.

A stop means do not use and do not hand out. A failed calibration or an overdue one stops an instrument by the register’s own rule. Only a person clears a stop, with the reason; an overdue stop stays until the calibration is recorded and approved.

Record each calibration or lab certificate with the date and the result. Someone approves it, and for safety-critical and GxP instruments that must be someone who did not do or record it. Approving a pass sets the next due date from the instrument’s interval.

Hand a thing out to a person or a place, take it back, send it to a lab, or mark it lost or found. Who has it now comes from that record. A stopped or overdue thing cannot be handed out, but it can be sent away to be calibrated.

Export a register as a spreadsheet file with every value as it is kept. Reminders come when something is due soon and again when it is overdue.

When something is due soon, and again when it is overdue, the person who has it and the person who looks after it get one email each. If nobody looks after it, the register’s lead is told.

Each thing on a register with due dates also shows in Compliance, once, with the register’s own dates. It counts as done only on an approved calibration or check.

Add a photo or PDF of a lab’s certificate to an instrument and it is read twice. A date is taken only when both reads agree; otherwise you type it as it is on the certificate. You pick the result and accept it, and someone else approves it, or you discard it with why. Athena never accepts one.

Starting a job, accepting a permit or sending an inspection with an instrument that is overdue, stopped or not known to be good is refused, naming the one in date to use instead. One limited to some uses goes through with a warning.

Where a tool control rule covers the job’s place, the job page has Start the tool tally: count the tools back for the job, and carry on with an open tally from the same place. Pick the meters and detectors you are using before you start; Start refuses one that is not in date.

Tool control says where tools must be counted back: which classes, at job or shift end, with a witness or not, and how long a tool may be out. A job there cannot close until its tally finds everything, where the rule says so. The shift-end tally opens itself at the time you set.

A count lists what should be there when it starts. Scan each one, or tick it by hand and say why. It is all found only when every line is found; anything not found shows as missing, with someone, or moved while you counted. A damaged one is stopped from use. The lead is told at once when something is not found.

A kit is a shadow board or toolbox: its tools from the tools register and its consumables by slot. It goes out and comes back as one. It shows complete, something missing, out, or do not use when a tool on it is stopped or overdue.

Only someone with the right declares a tool or key missing. That opens its case with the steps to follow and, for a key, what it opens. Anyone who finds it marks it found on the case. A case not found is closed by a person with why; a high one, such as a master key or a high-risk tool, needs a second person. Athena never declares or closes one.

Each key number says what it opens, its level, who may hold it, the longest loan and whether it may leave site. Each copy hangs in a cabinet and is handed out by the custodian. A restricted key is seen and handed out only by those allowed, never to themselves. The holder and the lead are told when a key is overdue back.

To hand a key to someone else, offer it to them and they accept it on their phone: both of you confirm. Keys you may take yourself can be taken at the kiosk.

Record an inspection or a pre-use check on a tool. A pass on an inspection sets the next due date; a fail stops the tool from use until a person clears it.

A week before someone’s last day, they, their line manager and each register’s lead get one list of every tool, key and kit they still have, to hand back. Things handed out after that come in a new list. Nothing is moved or marked lost for them: a person does that.

A key system shows the keys from the grand master down and every lock in it. What a key opens is worked out from the locks keyed to it and to every key under it, so a lost master shows every door it puts at risk. Only people allowed restricted keys see a key system.

Record each lock change with why, the new cylinder and the job. Recall only the copies that opened that lock. A recalled copy is destroyed in front of a witness, who is someone else.

To lend a key to a contractor, give the company, the person, when it comes back and any deposit, with a photo of their ID if you take one. You hold it on the register and you are chased for it. A key with a named list of holders is never lent out. Settle the deposit once the key is back.

Cards, fobs and phone passes are kept with the last four of their number only. Each night the list shows anyone who has left with an active card, contractors past their end date and cards not used for 90 days. Codes stay in the site vault: here you set how often each one changes and when a leaver or a finished contractor means it must.

An electronic key cabinet is read from its maker’s system: every hook, and anything that does not match the register. A reading never moves a key on the register; you settle each difference. If the cabinet cannot be reached the page says so, never that all keys are in.

When a tool or key is overdue back, Athena drafts a short chase for the person who has it. You read it, change the words if you like, and send it, or put it aside with why. Athena never sends one and never writes about a restricted key.

Every workspace starts with ten roles: Owner, Admin, Planner, Supervisor, Technician, Storekeeper, Finance, Requester, Viewer and Safety lead. You can make your own, from nothing or as a copy of another role, all of it or one section.

In Advanced, each thing a role can do is Allow, Deny or Off. Deny always wins, even over another role that allows it. Families such as “everything in work” never include security or safety-critical acts: those are given one by one.

Nobody can give what they do not hold themselves, so a role can never be made to reach further than the person changing it. Only an Owner makes an Admin or changes what Admins can do, and the Owner role always holds everything.

You cannot change a role you hold or your own roles; another administrator does it. A workspace always keeps at least one Owner.

Something your plan does not include cannot be given to a role. Features that are coming later show when they arrive and are never switched on early.

Every setting is one sentence with a value. Each module’s settings are in Settings under its own name, and the search finds any setting by what it does. Changes are recorded with who made them and why.

The audit trail records every change in the workspace, by anyone and anything, with who, when, what and how. Each entry is chained to the one before, so a changed or missing entry is found by Verify.

Verify recomputes the whole chain from the first entry and says whether it is whole, or where it breaks. Each check is itself recorded.

Predict & Maintain support can look inside your organisation only when you let them: ask each time (the default), never, or read-only without asking until a date you choose. Every look is recorded here and in the audit trail.

A support session has a reason and an end time, at most three days. Support can look but not change anything, and can never sign, approve or issue anything. You can end a session at any time.

Pause Athena stops every Athena job from acting at its next step: jobs only watch until you resume. One job can be paused on its own. A reason is always asked for.

Plan shows each feature as Included, Not in your plan, or Coming in a given quarter. Nothing is shown as included before it exists.

Ask us for help from Help in the app. Each case gets a number, a severity and the time we promised to answer by; you see our replies under Your support cases and can add to a case at any time.

If SOS, lone-worker checks, permits or isolations stop working, use Urgent: a safety function is not working. It asks which one and a number to call back, and goes straight to the person on call. A person answers within 1 hour, 08:00 to 20:00 UK time, every day. We are a small team. An urgent case that reaches us between 20:00 and 08:00 UK time is answered from 08:00. When a second person shares the on-call, these hours grow, and this page says so on the day.

When we mark a case fixed, confirm it or tell us it is not. A closed case can be reopened for 14 days.

You see the cases you raised. Owners and Admins see every case of the organisation. Our internal notes are never shown in the app.

Two-step verification asks for a six-digit code from an authenticator app as well as the password. Owners and Admins must use it, and so must anyone who approves money, signs safety records, makes API keys or exports data. Each person gets 7 days to turn it on once it is asked of them.

After the grace, an Owner or Admin without two-step can only turn it on; anyone else can do everything except the sensitive things until they do. Turning it on takes a minute in Settings, Two-step verification.

The security page lists every sign-in by your members: who, when, how, from which country and on what kind of device, including failed tries. It is kept for 12 months unless you choose otherwise.

Admin home lists what needs an administrator, worst first, at most 7 at a time, each with one button to the page that fixes it. It is checked every night and after any admin change. A finding can be set aside for up to 90 days with a reason, except a payment problem or a broken audit trail.

Export everything gives you every record you keep here as JSON and CSV files in one ZIP, with a list of every file and its fingerprint, the published schema, and the audit trail with its chain. It is free, whenever you want. The download link works for 7 days, and every download is recorded.

The data processing agreement says how we look after the personal data your people put in. An Owner accepts it once, in the app. We give 30 days’ notice before any supplier on the sub-processor list changes.

What's changing lists each release with what changes for each role, 14 days ahead. Security fixes are never put off.

Billing shows what you pay next, every invoice with its PDF, who gets the invoices and the tax details. The card and cancelling are on Stripe’s secure page, opened from the button.

Search the audit trail by date, by who or what made the change (a person, Athena, an API key, our support), by kind of record, by one record, by how it came in (web, phone, API, import) and by what happened. Save a search you use often under a name.

Open any entry to see exactly which fields changed from what to what, its place in the chain and its fingerprint. For a change Athena made, it links to the decision and its reasons.

Once a day the end of your audit chain is written to storage nobody can change, not even us. Verify checks the chain and that every anchored entry still matches, so a change made later and carefully hidden is still found.

Download the audit trail as a spreadsheet, or as a file with every fingerprint and the daily anchors. The file can be checked on your own computer, without us, with the offline checker.

Every download of the audit trail is itself written into the trail: who took it, which entries and the file’s fingerprint, so a copy can always be matched to its download.

Verify a range checks just the entries you choose, from the fingerprint of the entry before them. A change Athena made can be undone from its entry with Undo this change, the same way as from its decision.

Devices shows every phone, tablet and computer signed in to your organisation, its app version and when it was last seen. Lock signs a lost phone out of your organisation at its next contact. Wipe also clears your organisation’s copy on it, sending anything waiting to go first.

A contractor’s own phone shows as a guest device. Locking or wiping it only touches your organisation’s sign-in and copy: their employer’s data and other organisations on the same phone are left alone.

Your organisation’s records are sealed with its own encryption key, kept wrapped by a key service and never stored in the clear. The Owner can change it for a new one; what the old key sealed still opens. When an organisation is deleted its keys are destroyed, so every copy, backups included, can never be read again.

Sign in with your organisation lets your people use the work account your organisation already gives them. An Owner connects your provider once: for OpenID Connect the issuer, client id and secret; for SAML your provider’s metadata, with our entity id and reply address to copy into your provider.

A connection must be tested before it can be switched on: sign in through it once yourself from the sign-in page’s Test button. Any change to how it signs people in needs a new test.

Signing in through your provider never adds anyone. Only people who are already members here, with an email in one of your verified domains, can sign in this way; invite people as usual first.

Each email domain is proved before it matches anyone by email: add the TXT record shown on the page to the domain’s DNS, press Check, then Mark verified within an hour. A domain that is only typed in matches nobody.

When someone signs out at your provider, or your provider signs them out, their sessions here that came through it end too. Give your provider our sign-out address from the page. Each night we can also read your provider’s directory: members it has disabled are suspended here, never deleted. An Owner who keeps their own password, and anyone in a lone-working session, stay active and are listed as disabled at your provider, still active here.

A SAML provider signs with a certificate that runs out. Owners get an email 30 days before, 7 days before and on the day. Paste your provider’s new metadata and test the connection again before it runs out.

You can make your provider the only way in after a grace period of up to 90 days. At least one Owner keeps their own password in case your provider is down. If nobody manages to sign in through the provider within 15 minutes of the requirement starting, it switches itself back off, the reason is shown and every Owner gets an email.

Field groups let you hide or blank out whole kinds of detail for a role or a guest: rates, costs, personal details, site access codes and root cause before sign-off. Masked shows the field empty and says it is held back; Hidden leaves it out. A person sees a group as their most open role allows, and the Owner always sees everything. It applies everywhere the record is read: the app, the API and connected tools.

Provisioning (SCIM) lets your identity provider add, change and switch off members here for you. Make a token on the Provisioning page, copy it into your provider with our SCIM address, and pick the role new people get. Only people on your verified sign-in domains can be provisioned; Owners and Admins are always made by a person here.

When your provider switches someone off, they are suspended here and every record they made is kept. Someone working alone at that moment carries on under their supervisor and is suspended when the session ends; the Owners get an email.

Your identity provider can send its groups too. On the Provisioning page, pick the role each group gives: people then get exactly the roles their groups give, and lose a role when they leave the group. Your provider can never choose the roles itself, a group never gives the Owner or Admin role, and a role you gave someone by hand is never taken away.

An audit stream sends every change and security event to your own security tools as it happens: pushed to your collector’s https address as JSON lines or CEF, or ready made for Microsoft Sentinel, Splunk, Elastic or a syslog relay, each delivery signed, or read by your collector from us with its own token. Only what happened and which fields changed travel, never the values. If your collector cannot be reached five times in a row the stream pauses and Owners are told; nothing is lost and it carries on from where it stopped.

Your organisation’s data is kept in the region chosen when it was made: database, files, backups, search and logs. The United Kingdom region is open now; the European Union and United States regions open later. Guests who work with you work in your region. A move between regions is a job we do with your written consent.

The Reads tab of the audit trail lists every time someone was shown personal details: who it was, through which door (the app, the API, a connected tool, Athena or an extension), which kind of record, how many, and which personal fields. If a role’s field groups blank out or leave out personal details, nothing was shown and nothing is listed. Search one record to see who viewed that person’s details. Owners and Admins see this tab; nobody can change or delete what is in it.

Validated mode is for sites whose records are inspected under US FDA 21 CFR Part 11 or EU GMP Annex 11. One person proposes it and a second person confirms it. While it is on, every change to a controlled record needs a reason, nothing controlled is deleted, and every signature needs a fresh sign-in.

Validated mode never ends quietly. When someone asks for it to end, every Owner is emailed at once and it stays on for 30 days, so it can be called off. The request and the ending are both in the audit trail.

Each signature is made under a meaning, such as Reviewed or Approved, and the person sees its exact words before signing. If the words change later, past signatures keep the words they were signed under.

Every signature keeps the printed name, the date and time, the meaning, and a fingerprint of the record as it was signed. The signature list and its download show all of them, with the clock the times come from.

Markings are your own, such as Internal or Restricted. Each one says whether a marked record may be exported, printed, read by Athena or sent outside, and whether every read is logged. A record marked to stay inside never goes in a message to anyone outside your organisation.

Golden cases are things you rely on, written down as checks: a role may or may not do something, a setting has a value, a marking is handled a certain way. They run against your own records before every release. If one fails, that release waits for your organisation and we are told.

The validation pack is the evidence your quality team needs to validate the system: what it must do, how it does it, the risks, the install, operation and performance checks with our test counts and your golden case results, and the release notes.

Athena never signs, approves, or switches validated mode on or off. Those are always a person’s.

The same product runs in our cloud or on your own computers. On your own computers you can also run it with no connection to the outside world at all (air-gapped), and with Athena switched off. Settings, This edition shows which one runs here and everything that is off, with what happens instead.

When Athena is not in your edition, nothing is ever sent to an AI provider. Every job Athena would do is done by hand, and each page that would have shown Athena’s help says so plainly.

Your setup (settings, roles, forms, fields, rules and automations) can be saved as one file to keep in your own version control, and a changed file brought back. Before anything changes you see every difference and approve it; an import adds and changes, never removes. Forms arrive as drafts to publish, and fields and rules go through the usual Builder approval.

An organisation can have its own database instead of sharing one. We move it with a tested runbook: every table is copied, counted and checked, then the organisation switches over. Nothing is removed from the old database until a person on our side confirms.

Athena’s page shows what it is waiting for you to decide, what it did today and why, and anything it was stopped or stepped down from doing. It is under Admin.

Every decision Athena makes keeps its reasons, the checks it ran, what it could not see, how sure it was, and what happened next. Open "Why?" on any of them, from the log or from the record it is about.

When Athena needs a yes first, it asks the person or role who decides, and moves the question on if nobody answers in time: to the Admins, then the Owner. Outside working hours it goes to whoever is on call. The first answer counts.

You can answer Athena with no signal. Your answer is checked when the phone is back online; if things changed meanwhile, it is not used and you are told why.

Related questions come together: approve them all, or change some one by one and approve the rest. Safety drafts, money and anything Athena marked as unusual are always answered one at a time.

When Athena is allowed to act and tell you, the message says what it did with Undo and Why. Undo all this caused reverses everything that followed from it that can be reversed, and names what cannot.

If people change, reject or undo Athena three times or more, and more than a quarter of the time over 30 days, on the same kind of action, Athena asks more before it acts there and tells the Admins why. It never raises itself.

A supervisor or manager can stop Athena doing one job at their site, with a reason. It then only watches there until an Admin lets it act again. Safety alarms are never stopped this way.

The Owner can switch AI off for the whole organisation. Anything Athena would write or read with AI is left for a person, rules-only checks keep running, and safety alarms and messages are never affected.

Run without Athena, during an outage, keeps everything working as a normal system: nothing is lost, and Athena picks up again when it is switched back.

Reading certificates, paper forms, manuals and drawings costs credits, charged once when the reading starts and given back in full if it fails. Everyday work, and anything to do with safety messages, costs nothing. With no credits left, readings wait and nothing is lost.

Athena’s quality page shows, for each job, how often people changed, rejected or undid what it did over 30 and 90 days, why, the mistakes reported, and the messages it flagged as trying to give it orders. Under 30 decisions it says too few to tell. Approvals made too fast to have been read are left out.

If Athena got something wrong and it mattered, press Report a mistake on the decision. Say what happened and how serious it was. Athena at once asks more before it does that again; if it was Serious or Safety, it asks first on that whole job until an Admin confirms the fix.

Mistakes are shared with Predict & Maintain so we can fix the cause for everyone. An Admin can stop sharing one, except a Safety mistake: we must always know about those.

Athena checks every email, message, document and photo that comes in from outside for words trying to give it orders. A flagged message still reaches you as normal; Athena only asks first before acting on anything built from it. Safety messages are never held up. An Admin can mark a flag as not an injection.

When you share a mistake with us, one of our team takes it and says where it stands: Investigating, Fixed for you, Fixed for everyone (with what we changed) or Not a mistake (with why). Our replies show on the mistake. Only you can close it: confirm the fix, or say it is not fixed. A Safety mistake is taken within one working hour.

Athena’s trust page says, for each kind of thing it does, whether it has earned one level more freedom, should stay where it is, or should ask more. It only says "ready" after 90 days of your answers, and only when even the worst likely rate of people changing, turning down or undoing its work is under the limit. Until then it says about how many more checked decisions it needs.

Only a person raises Athena’s dial, one level at a time, from the trust page: an Owner or Admin, signed in recently, with a reason and the name of the Owner or Admin accountable for it. Athena never raises itself. Lowering it is always allowed, and Athena lowers itself when people keep changing what it does.

Some things never go on Athena’s dial at all: issuing or cancelling a permit, approving a safety document, approving a payment, closing an incident and signing. Only a person ever does them. Messages to people outside, spending, legal and access changes are never done quietly, and anything safety-critical always waits for a yes.

On the first of each month Athena drafts what it did last month: what it did for each job, how often people changed it, every mistake reported, what it could not see, the credits it used and what changed on its dial. An Owner or Admin checks it, can rewrite the summary, and publishes it. Time given back is an estimate, with the method shown, and never counted as money.

Once Athena does something without asking, a person keeps checking a few of the things it did. Each Monday about 3 in 100 of last week’s are picked at random for each job, at least 5 and at most 20, from every kind of record. Mark each one right, wrong (say why) or not sure. Skipping one picks another in its place; a skipped one never counts as right. If too many are wrong, Athena goes back to asking first.

For each job Athena acted on, Athena looks again a day after it was due: done in time and not reopened, or late, or back again. When the records do not say, it says it does not know. Athena is not given more freedom while what happened afterwards is clearly worse than when your own people did the same work.

Every level above Ask first names an Owner or Admin who is accountable for it. The moment that person leaves, is suspended or is no longer an Owner or Admin, the level goes back to Ask first and the Owner is asked whether to raise it again with someone new.

A partner sees their own page from the link we send them: how many came through their link and became customers, the statement by month and each transfer to them. A new link stops the old one.

A partner signs in to their partner page with a code we email to the address they joined with. The code works for 10 minutes and once; a sign-in lasts 12 hours, or until they sign out.

On the 1st of each month every partner gets an email with last month’s statement: paid invoices, what they earned, anything taken back after a refund, and what is due. Counts and amounts only, never a customer’s name.

If a customer is refunded within 60 days of paying, the partner’s share of that payment is taken back. A share not yet paid out simply stops counting; one already paid out shows as a line taken back, which comes off the next payout. Nothing is ever taken from the partner’s bank.

When your organisation’s email inbox is on, a reply to a getting-started email goes straight to that inbox, and the getting-started emails then stop.

The getting-started emails stop for good once an email from you reaches your organisation’s inbox here, and each one stops once its step is done.

Free for one site, up to 3 people and 2,000 assets. No card. Contractors can keep up to 25 customer addresses with work in the last 12 months on Free.

Team is £29 a month for each person who plans or manages and £9 for each person who does the work. Any number of sites.

Pro is £69 a month for each person who plans or manages and £19 for each person who does the work.

Requesters, viewers, contractors, clients and every other guest are free, with no limit.

You pay for the people. Each paid person who plans brings 2,000 assets, each who does the work 250; most teams never go over.

Paying yearly costs ten months and covers twelve.

Enterprise starts at £2,000 a month, billed yearly.

Everyday work is in the price: planning, dispatch, reminders, answers, the monthly report. Credits are for the heavy jobs: reading manuals, certificates, drawings and paper, building extensions, paid messages. Safety messages never cost credits and never stop.

Free includes 50 credits a month. Team includes 100 for each person who plans and 25 for each who does the work; Pro 250 and 50.

Read a manual or long document: 1 credit per 10 pages. Read a certificate or inspection report and raise remedials: 2 credits each. Read a paper form page into a digital form: 1 credit per page. Read a drawing or schematic: 5 credits per sheet. Read a contract and pull out the terms: 5 credits up to 50 pages, then 1 per 10 pages. Import another system’s export after the first: 10 credits per 10,000 records; the first import is free. Build an extension, tested and reviewed: 50 credits each; a rebuild after a failed test is free. A deep analysis beyond the monthly one: 20 credits each. Translate a document: 1 credit per 10 pages. Nameplate and photo reads: Free up to 2,000 a month, then 1 credit per 10. A text message: 1 credit per message segment. A WhatsApp message we start: 1 credit each. A voice call: 3 credits per minute. Safety messages: Never: safety messages never cost credits and never stop.

If a card payment fails, everything keeps working for 14 days and the Owner is told at once. Update the card in Billing before then.

If it is still not paid when that time is up, your organisation becomes read-only: nothing is deleted, everyone can still see and export everything, and safety reports still go in. Paying opens it again straight away.

Every invoice and credit note is kept in Billing with its PDF. The card, cancelling and receipts are handled on Stripe’s secure pages; card details never reach us.

Plan and features shows how much of each limit you use. You are told at 80%. When a limit is full only new things wait: everything you have keeps working, exports always work and safety never stops.

The Owner chooses a plan in Settings, Plan and features. The page shows your own people, what you pay today and each month or year after, before you pay. Prices are without VAT; Stripe adds VAT where it applies. Card details are typed only on Stripe’s page.

Add someone and they are charged for the rest of the billing period from that day. Take someone off and it applies at renewal: a period costs the most people you had in it. On monthly plans anyone who never signed in during the month is credited back on the next invoice, automatically.

Any feature Team adds can be tried for 14 days, once, with no card. When the preview ends the feature is locked again and nothing made in it is deleted.

The sign-up code comes by email within a minute or two. If it does not, look in junk or spam, press Send it again, or check the address. After two tries, Talk to us and a person will help.

Not live yet, with when it arrives: Requests by text, WhatsApp and phone (Q3 2027); Planning and scheduling by Athena, wall boards (Q1 2027); Forms and inspections, paper intake (Q1 2027); Compliance calendar and statutory register (Q1 2027); Documents and knowledge, Ask the manual (Q1 2027); Reporting and dashboards (Q1 2027); Incident and near-miss reporting, lone working with SOS (Q1 2027); Risk assessments and method statements (Q1 2027); Permits to work, basic: electrical, hot work and general (Q2 2027); Isolation register, work alongside other permits, switching and lock boxes (Q3 2027); Stores, parts, van stock and stock-takes (Q4 2027); Purchasing and suppliers (Q4 2027); Quotes, invoices and credit notes for your customers (Q2 2027); Xero and QuickBooks: invoices and customers pushed, paid status back (Q2 2027); Budgets and costs (Q2 2027); Contracts with service credits, settlements and recharges (Q4 2027); Webhooks and the MCP server (Q1 2027); Automations (Builder, step 2) (Q3 2027); Extensions (Builder, step 3) (Q1 2028); Live monitoring and predictions (Q1 2028); Reliability engineering: root cause, failure modes, availability (Q1 2028); Projects and capital planning (Q4 2027); Energy and sustainability (Q1 2028); Soft services, rounds and patrols (Q3 2027); Outages, shutdowns and turnarounds (Q4 2027); Calibration, tool and key control (Q4 2027); Your brand on the pages your clients see (Q2 2027); Full white label on your own domain (Q2 2028); API keys and the public API (Q1 2027); Sign in with your organisation (Q2 2027); Sandboxes (Q2 2027); Audit trail to your own systems (Q3 2027).

The Owner or an Admin can make your referral code. When an organisation that joined with it pays its first invoice, it gets 1,000 credits, and so do you once you pay too. Once per organisation.

Anyone can join as a referrer on the website and get a link at once. Consultants, contractors and trade bodies apply, and a person at Predict & Maintain decides. Shares are of money actually paid, never list price.

In your first two weeks you get at most one getting-started email a day and three in the first week, each about the next step you have not done yet. They stop once you have done it.

Build mine turns one sentence into a first sketch: your sites, equipment, the next 30 days, the checks we would track and a price. A clear sentence is drawn by fixed rules straight away. Only a sentence the rules cannot place is read by Athena, and she can only pick from the same lists of places and equipment: she never acts, and words that try to give her orders change nothing. Nothing is kept for a refusal; a sketch is kept 7 days.

Start free with this takes your sketch into sign-up. Once your workspace is made, setup starts with your sector, how many sites and the kinds of equipment already filled in, marked as from your sketch, for you to check or change. A sketch past its 7 days is simply left out and setup starts from the beginning.

A pilot is a time-boxed trial of the parts you need, with success criteria written down before it starts: free for up to 60 days, or up to 90 days for a quarter of the expected first year, credited against your first year if you carry on within 30 days of the end. Your Owner switches it on once every criterion has a target and a way of measuring it; nothing is rebuilt when you become a customer.

Each week Athena writes a short report on the pilot page: every success criterion against its baseline and target, with the figure from your reports, saying plainly when one is not met, and what Athena did that week. A week before the readout she drafts the readout pack; a person who runs the pilot reads it and approves it before it goes to anyone outside. She never changes a criterion, a target, a baseline or a price.

A weekly report stays inside your organisation until someone who runs the pilot presses Send to sponsor on the pilot page. It then goes once, by email, to the sponsor’s email on the pilot, in the report’s own words; the page says when it went and who sent it. A withdrawn report is never sent, and Athena never sends one.

With a shift pool you pay for the most pooled people signed in at the same time on any day of the month, not for everyone by name. Only people on Field roles can be pooled; Full seats are always named. If more people are signed in at once than the slots you bought, the extra is billed for that month and the Owner is told; nobody is ever locked out. Kiosks, SOS and lone-worker check-ins never count.

Enterprise prices are Pro seat prices with a volume band on the whole quantity: 15% off from 50 Full seats, 25% off from 200; from 1,000 seats we work the price out with you. A 2- or 3-year term fixes the price for the term and never renews into another multi-year term.